This was added when they opened up to the public as a compromise to users. You can set it per account in privacy proof settings (I personally do it so anti trans people can’t scrape my posts)

Apps implementing the API don’t always have to follow it, though. (They even say this when you set the option)